commit a4549d6588207a22ec0c5decc2dfc9fc9a1cde70
author deadbeef <deadbeef@webrtc.org> Fri Feb 10 17:26:22 2017 -0800
committer Commit bot <commit-bot@chromium.org> Sat Feb 11 01:26:22 2017 +0000
tree 103cdbe031fcdba1b83ac6e2fff591de0987396a
parent ef35b17c76eff9561b991fa5a0d5409235c7f39c

Fix SDP parsing crash due to missing track ID in "a=msid".

BUG=chromium:686405

Review-Url: https://codereview.webrtc.org/2676293003
Cr-Commit-Position: refs/heads/master@{#16545}

webrtc/pc/webrtcsdp.cc

diff --git a/webrtc/pc/webrtcsdp.cc b/webrtc/pc/webrtcsdp.cc
index 93b7727..ed49c34 100644
--- a/webrtc/pc/webrtcsdp.cc
+++ b/webrtc/pc/webrtcsdp.cc
@@ -2136,10 +2136,17 @@
     return ParseFailedExpectFieldNum(line, expected_fields, error);
   }
 
+  if (track_id->empty()) {
+    return ParseFailed(line, "Missing track ID in msid attribute.", error);
+  }
+
   // msid:<msid-id>
   if (!GetValue(field1, kAttributeMsid, stream_id, error)) {
     return false;
   }
+  if (stream_id->empty()) {
+    return ParseFailed(line, "Missing stream ID in msid attribute.", error);
+  }
   return true;
 }
 

webrtc/pc/webrtcsdp_unittest.cc

diff --git a/webrtc/pc/webrtcsdp_unittest.cc b/webrtc/pc/webrtcsdp_unittest.cc
index 75116e8..1a6a212 100644
--- a/webrtc/pc/webrtcsdp_unittest.cc
+++ b/webrtc/pc/webrtcsdp_unittest.cc
@@ -3446,3 +3446,36 @@
   JsepSessionDescription jdesc_output(kDummyString);
   EXPECT_FALSE(SdpDeserialize(kSdpWithInvalidCandidatePort, &jdesc_output));
 }
+
+// Test that "a=msid" with a missing track ID is rejected and doesn't crash.
+// Regression test for:
+// https://bugs.chromium.org/p/chromium/issues/detail?id=686405
+TEST_F(WebRtcSdpTest, DeserializeMsidAttributeWithMissingTrackId) {
+  static const char kSdpWithMissingTrackId[] =
+      "v=0\r\n"
+      "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n"
+      "s=-\r\n"
+      "t=0 0\r\n"
+      "m=audio 9 RTP/SAVPF 111\r\n"
+      "c=IN IP4 0.0.0.0\r\n"
+      "a=rtpmap:111 opus/48000/2\r\n"
+      "a=msid:stream_id \r\n";
+
+  JsepSessionDescription jdesc_output(kDummyString);
+  EXPECT_FALSE(SdpDeserialize(kSdpWithMissingTrackId, &jdesc_output));
+}
+
+TEST_F(WebRtcSdpTest, DeserializeMsidAttributeWithMissingStreamId) {
+  static const char kSdpWithMissingStreamId[] =
+      "v=0\r\n"
+      "o=- 18446744069414584320 18446462598732840960 IN IP4 127.0.0.1\r\n"
+      "s=-\r\n"
+      "t=0 0\r\n"
+      "m=audio 9 RTP/SAVPF 111\r\n"
+      "c=IN IP4 0.0.0.0\r\n"
+      "a=rtpmap:111 opus/48000/2\r\n"
+      "a=msid: track_id\r\n";
+
+  JsepSessionDescription jdesc_output(kDummyString);
+  EXPECT_FALSE(SdpDeserialize(kSdpWithMissingStreamId, &jdesc_output));
+}